A security-focused auditor that identifies transparency gaps in skill updates by verifying machine-readable deltas and chain-of-custody records.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install delta-disclosure-auditor
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install delta-disclosure-auditor using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Delta Disclosure Auditor?
The Delta Disclosure Auditor is a specialized tool designed to bridge the transparency gap in the lifecycle of AI agents. It ensures that every update to Openclaw Skills is accompanied by an auditable record of what changed, preventing the common issue where version increments hide material modifications in capability declarations or dependency sets. By making continuous monitoring tractable, this skill allows auditors to focus on specific changes—such as new outbound endpoints or dropped validation commands—rather than re-executing full audits on every version.
Version 1.1 of this auditor introduces advanced dimensions including risk-class binding, which scales disclosure requirements based on the skill's sensitivity, and chain-of-custody verification. It transforms informal changelogs into verifiable commitments by checking for cryptographic signatures and hash-chained versioning, ultimately determining whether a skill qualifies for automated updates based on its transparency profile.
Delta Disclosure Auditor Use Cases
- Monitoring version updates for Openclaw Skills to detect undisclosed capability expansions or hidden dependency bumps.
- Verifying the chain-of-custody for high-risk agents to ensure no versions have been tampered with or modified without a signature.
- Assessing update eligibility to determine if a skill should be allowed to auto-update or if it requires manual security review.
- Auditing registry infrastructure to ensure it supports machine-readable delta reporting for hosted agents.
How Delta Disclosure Auditor Works
- The auditor takes a skill identifier, a version range, or a registry endpoint as the primary input.
- It reconstructs the evolution of the skill by comparing artifacts across different versions, focusing on capabilities and dependencies.
- The system compares publisher-provided changelogs against the reconstructed diffs to identify material omissions or misleading claims.
- It evaluates the alignment between the skill's self-declared risk classification and its actual behavioral footprint.
- The tool checks for cryptographic signatures and hash-chain integrity to verify the chain-of-custody.
- A comprehensive report is issued with a disclosure verdict (Complete, Partial, Absent, or Misleading) and a recommended update eligibility status.
Delta Disclosure Auditor Setup
Ensure that curl and python3 are available in your environment before running the auditor.
# Install the auditor dependencies
# No environment variables are required for basic audits
# Audit a specific skill ID for transparency across versions
python3 delta_auditor.py --id <skill-identifier>
# Compare two specific versions for undisclosed changes
python3 delta_auditor.py --compare --v1 1.0.0 --v2 1.1.0
Delta Disclosure Auditor Data Schema & Taxonomy
| Component | Description |
|---|---|
| Capability Delta | A structured diff of added, removed, or scope-modified permissions. |
| Dependency Delta | A manifest of all library changes, including version bumps and new supply chain entries. |
| Validation Delta | A record of changes to the validation suite, identifying dropped tests or weakened assertions. |
| Risk-Class Binding | A mapping of risk classification (e.g., credential handler) to disclosure strictness. |
| Chain-of-Custody | A cryptographic log confirming signatures and the integrity of the hash chain across versions. |
Delta Disclosure Auditor Advanced Features
- Risk-class binding to enforce stricter disclosure requirements on high-sensitivity Openclaw Skills.
- Cryptographic chain-of-custody verification that ensures deltas are signed commitments rather than suggestions.
- Automated update eligibility assessment (Auto-Update, Manual-Review, or Suspended) based on disclosure scores.
- Behavioral scope change detection that flags new outbound endpoints or expanded file access even if the publisher omits them from the changelog.
SKILL.md
Loading
Related Openclaw Skills
Clone Farm Detector
A specialized tool for detecting coordinated clone campaigns and reputation gaming in AI agent marketplaces.
Capability Scope Expansion Watcher
A security auditing tool that identifies AI skills gradually claiming broader permissions through subtle, incremental version updates.
Capability Graph Mapper
A security analysis tool that uncovers hidden, emergent capabilities created when multiple AI agent skills are combined into a single agent.
Capability Composition Analyzer
A security analysis tool that identifies dangerous emergent behaviors created by the combination of individually safe agent skills.
Economic Incentive Misalignment Detector
A strategic diagnostic tool that identifies structural marketplace pressures favoring publication volume over security and safety quality.
Evolution Drift Detector
A specialized security utility that identifies how AI agent skills silently mutate and accumulate risks across multiple inheritance generations.
METADATA
Featured*
